[proxmark3-svn] / client / cmdlft55xx.c

//-----------------------------------------------------------------------------\r
//\r
// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
// at your option, any later version. See the LICENSE.txt file for the text of\r
// the license.\r
//-----------------------------------------------------------------------------\r
// Low frequency T55xx commands\r
//-----------------------------------------------------------------------------\r
\r
#include <stdio.h>\r
#include <string.h>\r
#include <inttypes.h>\r
#include "proxmark3.h"\r
#include "ui.h"\r
#include "graph.h"\r
#include "cmdmain.h"\r
#include "cmdparser.h"\r
#include "cmddata.h"\r
#include "cmdlf.h"\r
#include "cmdlft55xx.h"\r
#include "util.h"\r
#include "data.h"\r
#include "lfdemod.h"\r
#include "../common/crc.h"\r
\r
#define LF_TRACE_BUFF_SIZE 20000 // 32 x 32 x 10  (32 bit times numofblock (7), times clock skip..)\r
#define LF_BITSSTREAM_LEN 1000 // more then 1000 bits shouldn't happend..  8block * 4 bytes * 8bits = \r
\r
//  0 = FSK\r
//  1 = ASK\r
//  2 = PSK\r
//  4 = NZR (direct)\r
typedef struct {\r
	uint8_t modulation;\r
	bool inversed;\r
	uint32_t block0;\r
} t55xx_conf_block;\r
\r
// Default configuration: FSK, not inversed.\r
t55xx_conf_block config = {0x00, FALSE, 0x00};\r
\r
	// FSK\r
	// FSK inverted\r
	//FSKrawDemod("", FALSE)\r
	//FSKrawDemod("1", FALSE)\r
\r
	// ASK/MAN\r
	// ASK/MAN inverted\r
	//ASKmanDemod("", FALSE, FALSE)\r
	\r
	// NZR (autoclock, normal, maxerrors 1)\r
	// NZR (autoclock, inverse, maxerrors 1)\r
	//NRZrawDemod("0 0 1", FALSE) ) {\r
		\r
	// PSK (autoclock, normal, maxerrors 1)\r
	// PSK (autoclock, inverse, maxerrors 1)\r
	//PSKDemod("0 0 1", FALSE)\r
\r
int usage_t55xx_config(){\r
	PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 0|1]");\r
	PrintAndLog("Options:        ");\r
	PrintAndLog("       h             This help");\r
	PrintAndLog("       d <>          Set demodulation FSK / ASK / PSK / NZR");\r
	PrintAndLog("       i [0|1]       Inverse data signal, Default: 0");\r
	PrintAndLog("Examples:");\r
	PrintAndLog("      lf t55xx config d FSK ");\r
	PrintAndLog("                    FSK demodulation");\r
	PrintAndLog("      lf t55xx config d FSK i 1");\r
	PrintAndLog("                    FSK demodulation, inverse data");\r
	PrintAndLog("      lf dump");\r
	PrintAndLog("                    Dumps all block from tag");\r
	PrintAndLog("      lf trace");\r
	PrintAndLog("                    Read trace block and decode it");\r
	PrintAndLog("      lf info");\r
	PrintAndLog("                    Read configuration and decode it");\r
	return 0;\r
}\r
int usage_t55xx_read(){\r
	PrintAndLog("Usage:  lf t55xx read <block> <password>");\r
    PrintAndLog("     <block>, block number to read. Between 0-7");\r
    PrintAndLog("     <password>, OPTIONAL password (8 hex characters)");\r
    PrintAndLog("");\r
    PrintAndLog("    sample: lf t55xx read 0           = try reading data from block 0");\r
	PrintAndLog("          : lf t55xx read 0 feedbeef  = try reading data from block 0 using password");\r
	PrintAndLog("");\r
	return 0;\r
}\r
int usage_t55xx_write(){\r
	PrintAndLog("Usage:  lf t55xx wr <block> <data> [password]");\r
    PrintAndLog("     <block>, block number to read. Between 0-7");\r
	PrintAndLog("     <data>,  4 bytes of data to write (8 hex characters)");\r
    PrintAndLog("     [password], OPTIONAL password 4bytes (8 hex characters)");\r
    PrintAndLog("");\r
    PrintAndLog("    sample: lf t55xx wd 3 11223344  = try writing data 11223344 to block 3");\r
	PrintAndLog("          : lf t55xx wd 3 11223344 feedbeef  = try writing data 11223344 to block 3 using password feedbeef");\r
	PrintAndLog("");\r
	return 0;\r
}\r
int usage_t55xx_trace() {\r
	PrintAndLog("Usage:  lf t55xx trace  [graph buffer data]");\r
	PrintAndLog("     [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");\r
	PrintAndLog("");\r
	PrintAndLog("     sample: lf t55xx trace");\r
	PrintAndLog("           : lf t55xx trace 1");\r
	PrintAndLog("");\r
	return 0;\r
}\r
int usage_t55xx_info() {\r
	PrintAndLog("Usage:  lf t55xx info [graph buffer data]");\r
	PrintAndLog("     [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");\r
	PrintAndLog("");\r
	PrintAndLog("    sample: lf t55xx info");\r
	PrintAndLog("          : lf t55xx info 1");\r
	PrintAndLog("");\r
	return 0;\r
}\r
int usage_t55xx_dump(){\r
	PrintAndLog("Usage:  lf t55xx dump <password>");\r
    PrintAndLog("     <password>, OPTIONAL password 4bytes (8 hex characters)");\r
	PrintAndLog("");\r
	PrintAndLog("        sample: lf t55xx dump");\r
	PrintAndLog("              : lf t55xx dump feedbeef");\r
	PrintAndLog("");\r
	return 0;\r
}\r
\r
static int CmdHelp(const char *Cmd);\r
\r
int CmdT55xxSetConfig(const char *Cmd){\r
	\r
	uint8_t paramNum =0;\r
	if(param_getchar(Cmd, paramNum) == 'h')\r
	{\r
		return usage_t55xx_config();\r
	}\r
\r
	uint8_t buff[] = { 0x01, 0x01, 0x01, 0x01,\r
					   0x01, 0x01, 0x01, 0x01,\r
					   0x01, 0x40, 0x01, 0x01, 0x04 };\r
	PrintAndLog("CRC-8: %x",CRC8Maxim(buff, 13));\r
\r
	//config = { 0, FALSE};\r
	return 0;\r
}\r
\r
// detect configuration?\r
\r
int CmdReadBlk(const char *Cmd)\r
{\r
	int block = -1;\r
	int password = 0xFFFFFFFF; //default to blank Block 7\r
\r
	char cmdp = param_getchar(Cmd, 0);\r
	if (cmdp == 'h' || cmdp == 'H')\r
		return usage_t55xx_read();\r
\r
	int res = sscanf(Cmd, "%d %x", &block, &password);\r
\r
	if ( res < 1 || res > 2 ){\r
		usage_t55xx_read();\r
		return 1;\r
	}\r
	\r
	if ((block < 0) | (block > 7)) {\r
		PrintAndLog("Block must be between 0 and 7");\r
		return 1;\r
	}	\r
\r
	UsbCommand c = {CMD_T55XX_READ_BLOCK, {0, block, 0}};\r
 	c.d.asBytes[0] = 0x0; \r
\r
	//Password mode\r
	if ( res == 2 ) {\r
		c.arg[2] = password;\r
		c.d.asBytes[0] = 0x1; \r
	}\r
\r
	SendCommand(&c);\r
	if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r
		PrintAndLog("command execution time out");\r
		return 2;\r
	}\r
	\r
	uint8_t got[12000];\r
	GetFromBigBuf(got,sizeof(got),0);\r
	WaitForResponse(CMD_ACK,NULL);\r
\r
	setGraphBuf(got, 12000);\r
\r
	if (block == 0){\r
		// try a detection.\r
		\r
	}\r
	\r
	if (CmdDetectClockRate("f")){ //wave is almost certainly FSK\r
      //call FSK DEMOD\r
	  	// FSK\r
		if ( FSKrawDemod("", FALSE))\r
			printT55xx("FSK");\r
		// FSK inverted\r
		if ( FSKrawDemod("1", FALSE)) \r
			printT55xx("FSK inv");\r
    } else {\r
		// ASK/MAN (autoclock, normal, maxerrors 1)\r
		if ( ASKmanDemod("0 0 1", FALSE, FALSE) )\r
			printT55xx("ASK/MAN");\r
		\r
		// ASK/MAN (autoclock, inverted, maxerrors 1)\r
		if ( ASKmanDemod("0 1 1", FALSE, FALSE) )\r
			printT55xx("ASK/MAN Inv");\r
\r
		// NZR (autoclock, normal, maxerrors 1)\r
		if  ( NRZrawDemod("0 0 1", FALSE) )\r
			printT55xx("NZR");\r
		// NZR (autoclock, inverted, maxerrors 1)\r
		if  ( NRZrawDemod("0 1 1", FALSE) )\r
			printT55xx("NZR inv");\r
		\r
		// PSK (autoclock, normal, maxerrors 1)\r
		if (!PSKDemod("0 0 1", FALSE))\r
			printT55xx("PSK");\r
\r
		// PSK (autoclock, inverted, maxerrors 1)\r
		if (!PSKDemod("0 1 1", FALSE))\r
			printT55xx("PSK inv");\r
	}\r
	return 0;\r
}\r
\r
void printT55xx(const char *demodStr){\r
	\r
	uint32_t blockData = 0;\r
	uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};\r
		\r
	if ( !DemodBufferLen) \r
		return;\r
	\r
	int i =0;\r
    for (;i<DemodBufferLen;++i)\r
		bits[i]=DemodBuffer[i];\r
	\r
	blockData = PackBits(1, 32, bits);\r
	PrintAndLog("0x%08X  %s [%s]", blockData, sprint_bin(bits+1,32), demodStr );\r
}\r
\r
/*\r
FSK1 / FSK1a\r
size = fskdemod(dest, size, 32, 0, 8, 10);  // fsk1 RF/32 \r
size = fskdemod(dest, size, 32, 1, 8, 10);  // fsk1a RF/32 \r
\r
FSK2 / FSK2a\r
size = fskdemod(dest, size, 32, 0, 10, 8);  // fsk2 RF/32 \r
size = fskdemod(dest, size, 32, 1, 10, 8);  // fsk2a RF/32 \r
size = fskdemod(dest, size, 50, 1, 10, 8);  // fsk2a RF/50 \r
size = fskdemod(dest, size, 64, 1, 10, 8);  // FSK2a RF/64 \r
\r
PSK1\r
errCnt = pskRawDemod(bits, &bitlen, 32, 0);\r
*/\r
int CmdWriteBlk(const char *Cmd)\r
{\r
	int block = 8; //default to invalid block\r
	int data = 0xFFFFFFFF; //default to blank Block \r
	int password = 0xFFFFFFFF; //default to blank Block 7\r
	\r
	char cmdp = param_getchar(Cmd, 0);\r
	if (cmdp == 'h' || cmdp == 'H') {\r
		usage_t55xx_write();\r
		return 0;\r
	}\r
  \r
	int res = sscanf(Cmd, "%d %x %x",&block, &data, &password);\r
	\r
	if ( res < 2 || res > 3) {\r
		usage_t55xx_write();\r
		return 1;\r
	}\r
\r
	if (block > 7) {\r
		PrintAndLog("Block must be between 0 and 7");\r
		return 1;\r
	}\r
	\r
	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};\r
 	c.d.asBytes[0] = 0x0; \r
\r
	PrintAndLog("Writing to T55x7");\r
	PrintAndLog("block : %d", block);\r
	PrintAndLog("data  : 0x%08X", data);\r
\r
	//Password mode\r
	if (res == 3) {\r
		c.arg[2] = password;\r
		c.d.asBytes[0] = 0x1; \r
		PrintAndLog("pwd   : 0x%08X", password);\r
	}\r
	SendCommand(&c);\r
	return 0;\r
}\r
\r
int CmdReadTrace(const char *Cmd)\r
{\r
	uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};\r
\r
	char cmdp = param_getchar(Cmd, 0);\r
	\r
	if (strlen(Cmd) > 1 || cmdp == 'h' || cmdp == 'H') {\r
		usage_t55xx_trace();\r
		return 0;\r
	}\r
\r
	if ( strlen(Cmd)==0){\r
	\r
		UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};\r
		SendCommand(&c);\r
		if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r
			PrintAndLog("command execution time out");\r
			return 1;\r
		}\r
		//darn\r
		//CmdSamples("12000");\r
	}\r
	\r
	size_t bitlen = getFromGraphBuf(bits);\r
	if ( bitlen == 0 )\r
		return 2;\r
	\r
	RepaintGraphWindow();\r
\r
	uint8_t si = 5;\r
	uint32_t bl0     = PackBits(si, 32, bits);\r
	uint32_t bl1     = PackBits(si+32, 32, bits);\r
	\r
	uint32_t acl     = PackBits(si,  8, bits); si += 8;\r
	uint32_t mfc     = PackBits(si, 8, bits); si += 8;\r
	uint32_t cid     = PackBits(si, 5, bits); si += 5;\r
	uint32_t icr     = PackBits(si, 3, bits); si += 3;\r
	uint32_t year    = PackBits(si, 4, bits); si += 4;\r
	uint32_t quarter = PackBits(si, 2, bits); si += 2;\r
	uint32_t lotid    = PackBits(si, 12, bits); si += 12;\r
	uint32_t wafer   = PackBits(si, 5, bits); si += 5;\r
	uint32_t dw      = PackBits(si, 15, bits); \r
	\r
	PrintAndLog("");\r
	PrintAndLog("-- T55xx Trace Information ----------------------------------");\r
	PrintAndLog("-------------------------------------------------------------");\r
	PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1)  : 0x%02X (%d)", acl, acl);\r
	PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6)    : 0x%02X (%d)", mfc, mfc);\r
	PrintAndLog(" CID                                     : 0x%02X (%d)", cid, cid);\r
	PrintAndLog(" ICR IC Revision                         : %d",icr );\r
	PrintAndLog(" Manufactured");\r
	PrintAndLog("     Year/Quarter : %d/%d",2000+year, quarter );\r
	PrintAndLog("     Lot ID       : %d", lotid );\r
	PrintAndLog("     Wafer number : %d", wafer);\r
	PrintAndLog("     Die Number   : %d", dw);\r
	PrintAndLog("-------------------------------------------------------------");\r
	PrintAndLog(" Raw Data - Page 1");\r
	PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bits+5,32) );\r
	PrintAndLog("     Block 0  : 0x%08X  %s", bl1, sprint_bin(bits+37,32) );\r
	PrintAndLog("-------------------------------------------------------------");\r
	/*\r
	TRACE - BLOCK O\r
		Bits	Definition								HEX\r
		1-8		ACL Allocation class (ISO/IEC 15963-1)	0xE0 \r
		9-16	MFC Manufacturer ID (ISO/IEC 7816-6)	0x15 Atmel Corporation\r
		17-21	CID										0x1 = Atmel ATA5577M1  0x2 = Atmel ATA5577M2 \r
		22-24	ICR IC revision\r
		25-28	YEAR (BCD encoded) 						9 (= 2009)\r
		29-30	QUARTER									1,2,3,4 \r
		31-32	LOT ID\r
	\r
	TRACE - BLOCK 1\r
		1-12	LOT ID  \r
		13-17	Wafer number\r
		18-32	DW,  die number sequential\r
	*/\r
	\r
  return 0;\r
}\r
\r
int CmdInfo(const char *Cmd){\r
	/*\r
		Page 0 Block 0 Configuration data.\r
		Normal mode\r
		Extended mode\r
	*/\r
	char cmdp = param_getchar(Cmd, 0);\r
\r
	if (cmdp == 'h' || cmdp == 'H') {\r
		return usage_t55xx_info();\r
	} else {\r
		CmdReadBlk("0");\r
	}	\r
\r
	// config\r
	\r
	uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};\r
\r
	uint8_t si = 1;\r
	uint32_t bl0      = PackBits(si, 32, bits);\r
	\r
	uint32_t safer    = PackBits(si, 4, bits); si += 4;	\r
	uint32_t resv     = PackBits(si, 7, bits); si += 7;\r
	uint32_t dbr      = PackBits(si, 3, bits); si += 3;\r
	uint32_t extend   = PackBits(si, 1, bits); si += 1;\r
	uint32_t datamodulation   = PackBits(si, 5, bits); si += 5;\r
	uint32_t pskcf    = PackBits(si, 2, bits); si += 2;\r
	uint32_t aor      = PackBits(si, 1, bits); si += 1;	\r
	uint32_t otp      = PackBits(si, 1, bits); si += 1;	\r
	uint32_t maxblk   = PackBits(si, 3, bits); si += 3;\r
	uint32_t pwd      = PackBits(si, 1, bits); si += 1;	\r
	uint32_t sst      = PackBits(si, 1, bits); si += 1;	\r
	uint32_t fw       = PackBits(si, 1, bits); si += 1;\r
	uint32_t inv      = PackBits(si, 1, bits); si += 1;	\r
	uint32_t por      = PackBits(si, 1, bits); si += 1;\r
		\r
	PrintAndLog("");\r
	PrintAndLog("-- T55xx Configuration & Tag Information --------------------");\r
	PrintAndLog("-------------------------------------------------------------");\r
	PrintAndLog(" Safer key                 : %s", GetSaferStr(safer));\r
	PrintAndLog(" reserved                  : %d", resv);\r
	PrintAndLog(" Data bit rate             : %s", GetBitRateStr(dbr));\r
	PrintAndLog(" eXtended mode             : %s", (extend) ? "Yes - Warning":"No");\r
	PrintAndLog(" Modulation                : %s", GetModulationStr(datamodulation) );\r
	PrintAndLog(" PSK clock freq            : %d", pskcf);\r
	PrintAndLog(" AOR - Answer on Request   : %s", (aor) ? "Yes":"No");\r
	PrintAndLog(" OTP - One Time Pad        : %s", (otp) ? "Yes - Warning":"No" );\r
	PrintAndLog(" Max block                 : %d", maxblk);\r
	PrintAndLog(" Password mode             : %s", (pwd) ? "Yes":"No");\r
	PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");\r
	PrintAndLog(" Fast Write                : %s", (fw) ? "Yes":"No");\r
	PrintAndLog(" Inverse data              : %s", (inv) ? "Yes":"No");\r
	PrintAndLog(" POR-Delay                 : %s", (por) ? "Yes":"No");\r
	PrintAndLog("-------------------------------------------------------------");\r
	PrintAndLog(" Raw Data - Page 0");\r
	PrintAndLog("     Block 0  : 0x%08X  %s", bl0, sprint_bin(bits+5,32) );\r
	PrintAndLog("-------------------------------------------------------------");\r
	\r
	return 0;\r
}\r
\r
int CmdDump(const char *Cmd){\r
\r
	char s[20] = {0x00};\r
	uint8_t pwd[4] = {0x00};\r
\r
	char cmdp = param_getchar(Cmd, 0);\r
	if ( cmdp == 'h' || cmdp == 'H') {\r
		usage_t55xx_dump();\r
		return 0;\r
	}\r
\r
	bool hasPwd = ( strlen(Cmd) > 0);	\r
	if ( hasPwd ){\r
		if (param_gethex(Cmd, 0, pwd, 8)) {\r
			PrintAndLog("password must include 8 HEX symbols");\r
			return 1;\r
		}\r
	}\r
	\r
	for ( int i = 0; i <8; ++i){\r
		memset(s,0,sizeof(s));\r
		if ( hasPwd ) {\r
			sprintf(s,"%d %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);\r
		} else {\r
			sprintf(s,"%d", i);\r
		}\r
		CmdReadBlk(s);\r
	}\r
	return 0;\r
}\r
\r
char * GetBitRateStr(uint32_t id){\r
 	static char buf[40];\r
	char *retStr = buf;\r
		switch (id){\r
		case 0: \r
			sprintf(retStr,"%d - RF/8",id);\r
			break;\r
		case 1:\r
			sprintf(retStr,"%d - RF/16",id);\r
			break;\r
		case 2:		\r
			sprintf(retStr,"%d - RF/32",id);\r
			break;\r
		case 3:\r
			sprintf(retStr,"%d - RF/40",id);\r
			break;\r
		case 4:\r
			sprintf(retStr,"%d - RF/50",id);\r
			break;\r
		case 5:\r
			sprintf(retStr,"%d - RF/64",id);\r
			break;\r
		case 6:\r
			sprintf(retStr,"%d - RF/100",id);\r
			break;\r
		case 7:\r
			sprintf(retStr,"%d - RF/128",id);\r
			break;\r
		default:\r
			sprintf(retStr,"%d - (Unknown)",id);\r
			break;\r
		}\r
\r
	return buf;\r
}\r
\r
char * GetSaferStr(uint32_t id){\r
 	static char buf[40];\r
	char *retStr = buf;\r
	\r
	sprintf(retStr,"%d",id);\r
	if (id == 6) {\r
		sprintf(retStr,"%d - pasdwd",id);\r
	}\r
	if (id == 9 ){\r
		sprintf(retStr,"%d - testmode ",id);\r
	}\r
	\r
	return buf;\r
}\r
char * GetModulationStr( uint32_t id){\r
 	static char buf[40];\r
	char *retStr = buf;\r
	\r
	switch (id){\r
		case 0: \r
			sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);\r
			break;\r
		case 1:\r
			sprintf(retStr,"%d - PSK 1 phase change when input changes",id);\r
			break;\r
		case 2:		\r
			sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);\r
			break;\r
		case 3:\r
			sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);\r
			break;\r
		case 4:\r
			sprintf(retStr,"%d - FSK 1 RF/8  RF/5",id);\r
			break;\r
		case 5:\r
			sprintf(retStr,"%d - FSK 2 RF/8  RF/10",id);\r
			break;\r
		case 6:\r
			sprintf(retStr,"%d - FSK 1a RF/5  RF/8",id);\r
			break;\r
		case 7:\r
			sprintf(retStr,"%d - FSK 2a RF/10  RF/8",id);\r
			break;\r
		case 8:\r
			sprintf(retStr,"%d - Manschester",id);\r
			break;\r
		case 16:\r
			sprintf(retStr,"%d - Biphase",id);\r
			break;\r
		case 17:\r
			sprintf(retStr,"%d - Reserved",id);\r
			break;\r
		default:\r
			sprintf(retStr,"0x%02X (Unknown)",id);\r
			break;\r
		}\r
	return buf;\r
}\r
\r
uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){\r
	\r
	int i = start;\r
	int j = len-1;\r
	if (len > 32) {\r
		return 0;\r
	}\r
 	uint32_t tmp = 0;\r
	for (; j >= 0; --j, ++i){\r
		tmp	|= bits[i] << j;\r
	}\r
	return tmp;\r
}\r
\r
static command_t CommandTable[] =\r
{\r
  {"help",   CmdHelp,           1, "This help"},\r
  {"config", CmdT55xxSetConfig, 1, "Set T55XX config for modulation, inversed data"},\r
  {"read",   CmdReadBlk,        0, "<block> [password] -- Read T55xx block data (page 0) [optional password]"},\r
  {"write",  CmdWriteBlk,       0, "<block> <data> [password] -- Write T55xx block data (page 0) [optional password]"},\r
  {"trace",  CmdReadTrace,      0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},\r
  {"info",   CmdInfo,           0, "[1] Read T55xx configuration data (page 0/ blk 0)"},\r
  {"dump",   CmdDump,           0, "[password] Dump T55xx card block 0-7. [optional password]"},\r
  {NULL, NULL, 0, NULL}\r
};\r
\r
int CmdLFT55XX(const char *Cmd)\r
{\r
  CmdsParse(CommandTable, Cmd);\r
  return 0;\r
}\r
\r
int CmdHelp(const char *Cmd)\r
{\r
  CmdsHelp(CommandTable);\r
  return 0;\r
}\r
Commit	Line	Data
54a942b0	1	//-----------------------------------------------------------------------------\r
	2	//\r
	3	// This code is licensed to you under the terms of the GNU GPL, version 2 or,\r
	4	// at your option, any later version. See the LICENSE.txt file for the text of\r
	5	// the license.\r
	6	//-----------------------------------------------------------------------------\r
	7	// Low frequency T55xx commands\r
	8	//-----------------------------------------------------------------------------\r
	9	\r
	10	#include <stdio.h>\r
	11	#include <string.h>\r
	12	#include <inttypes.h>\r
54a942b0	13	#include "proxmark3.h"\r
	14	#include "ui.h"\r
	15	#include "graph.h"\r
f38a1528	16	#include "cmdmain.h"\r
54a942b0	17	#include "cmdparser.h"\r
	18	#include "cmddata.h"\r
	19	#include "cmdlf.h"\r
	20	#include "cmdlft55xx.h"\r
f38a1528	21	#include "util.h"\r
f38a1528	22	#include "data.h"\r
c4e3b1b6	23	#include "lfdemod.h"\r
83a42ef9	24	#include "../common/crc.h"\r
54a942b0	25	\r
8d0a3e87	26	#define LF_TRACE_BUFF_SIZE 20000 // 32 x 32 x 10 (32 bit times numofblock (7), times clock skip..)\r
c6be64da	27	#define LF_BITSSTREAM_LEN 1000 // more then 1000 bits shouldn't happend.. 8block * 4 bytes * 8bits = \r
54a942b0	28	\r
83a42ef9	29	// 0 = FSK\r
	30	// 1 = ASK\r
	31	// 2 = PSK\r
	32	// 4 = NZR (direct)\r
	33	typedef struct {\r
	34	uint8_t modulation;\r
	35	bool inversed;\r
	36	uint32_t block0;\r
	37	} t55xx_conf_block;\r
	38	\r
	39	// Default configuration: FSK, not inversed.\r
	40	t55xx_conf_block config = {0x00, FALSE, 0x00};\r
	41	\r
	42	// FSK\r
	43	// FSK inverted\r
	44	//FSKrawDemod("", FALSE)\r
	45	//FSKrawDemod("1", FALSE)\r
	46	\r
	47	// ASK/MAN\r
	48	// ASK/MAN inverted\r
	49	//ASKmanDemod("", FALSE, FALSE)\r
	50	\r
	51	// NZR (autoclock, normal, maxerrors 1)\r
	52	// NZR (autoclock, inverse, maxerrors 1)\r
	53	//NRZrawDemod("0 0 1", FALSE) ) {\r
	54	\r
	55	// PSK (autoclock, normal, maxerrors 1)\r
	56	// PSK (autoclock, inverse, maxerrors 1)\r
	57	//PSKDemod("0 0 1", FALSE)\r
	58	\r
	59	int usage_t55xx_config(){\r
	60	PrintAndLog("Usage: lf t55xx config [d <demodulation>] [i 0\|1]");\r
	61	PrintAndLog("Options: ");\r
	62	PrintAndLog(" h This help");\r
	63	PrintAndLog(" d <> Set demodulation FSK / ASK / PSK / NZR");\r
	64	PrintAndLog(" i [0\|1] Inverse data signal, Default: 0");\r
	65	PrintAndLog("Examples:");\r
	66	PrintAndLog(" lf t55xx config d FSK ");\r
	67	PrintAndLog(" FSK demodulation");\r
	68	PrintAndLog(" lf t55xx config d FSK i 1");\r
	69	PrintAndLog(" FSK demodulation, inverse data");\r
	70	PrintAndLog(" lf dump");\r
	71	PrintAndLog(" Dumps all block from tag");\r
	72	PrintAndLog(" lf trace");\r
	73	PrintAndLog(" Read trace block and decode it");\r
	74	PrintAndLog(" lf info");\r
	75	PrintAndLog(" Read configuration and decode it");\r
	76	return 0;\r
	77	}\r
68008fb5	78	int usage_t55xx_read(){\r
68008fb5	79	PrintAndLog("Usage: lf t55xx read <block> <password>");\r
4ecde0e1	80	PrintAndLog(" <block>, block number to read. Between 0-7");\r
	81	PrintAndLog(" <password>, OPTIONAL password (8 hex characters)");\r
	82	PrintAndLog("");\r
68008fb5	83	PrintAndLog(" sample: lf t55xx read 0 = try reading data from block 0");\r
68008fb5	84	PrintAndLog(" : lf t55xx read 0 feedbeef = try reading data from block 0 using password");\r
4ecde0e1	85	PrintAndLog("");\r
	86	return 0;\r
	87	}\r
68008fb5	88	int usage_t55xx_write(){\r
4ecde0e1	89	PrintAndLog("Usage: lf t55xx wr <block> <data> [password]");\r
	90	PrintAndLog(" <block>, block number to read. Between 0-7");\r
	91	PrintAndLog(" <data>, 4 bytes of data to write (8 hex characters)");\r
	92	PrintAndLog(" [password], OPTIONAL password 4bytes (8 hex characters)");\r
	93	PrintAndLog("");\r
	94	PrintAndLog(" sample: lf t55xx wd 3 11223344 = try writing data 11223344 to block 3");\r
	95	PrintAndLog(" : lf t55xx wd 3 11223344 feedbeef = try writing data 11223344 to block 3 using password feedbeef");\r
	96	PrintAndLog("");\r
	97	return 0;\r
	98	}\r
	99	int usage_t55xx_trace() {\r
	100	PrintAndLog("Usage: lf t55xx trace [graph buffer data]");\r
	101	PrintAndLog(" [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");\r
	102	PrintAndLog("");\r
	103	PrintAndLog(" sample: lf t55xx trace");\r
	104	PrintAndLog(" : lf t55xx trace 1");\r
	105	PrintAndLog("");\r
	106	return 0;\r
	107	}\r
	108	int usage_t55xx_info() {\r
	109	PrintAndLog("Usage: lf t55xx info [graph buffer data]");\r
	110	PrintAndLog(" [graph buffer data], if set, use Graphbuffer otherwise read data from tag.");\r
	111	PrintAndLog("");\r
	112	PrintAndLog(" sample: lf t55xx info");\r
	113	PrintAndLog(" : lf t55xx info 1");\r
	114	PrintAndLog("");\r
	115	return 0;\r
	116	}\r
4ecde0e1	117	int usage_t55xx_dump(){\r
	118	PrintAndLog("Usage: lf t55xx dump <password>");\r
	119	PrintAndLog(" <password>, OPTIONAL password 4bytes (8 hex characters)");\r
	120	PrintAndLog("");\r
	121	PrintAndLog(" sample: lf t55xx dump");\r
	122	PrintAndLog(" : lf t55xx dump feedbeef");\r
	123	PrintAndLog("");\r
	124	return 0;\r
	125	}\r
0310364d	126	\r
4ecde0e1	127	static int CmdHelp(const char *Cmd);\r
c4e3b1b6	128	\r
83a42ef9	129	int CmdT55xxSetConfig(const char *Cmd){\r
	130	\r
	131	uint8_t paramNum =0;\r
	132	if(param_getchar(Cmd, paramNum) == 'h')\r
	133	{\r
	134	return usage_t55xx_config();\r
	135	}\r
	136	\r
	137	uint8_t buff[] = { 0x01, 0x01, 0x01, 0x01,\r
	138	0x01, 0x01, 0x01, 0x01,\r
	139	0x01, 0x40, 0x01, 0x01, 0x04 };\r
	140	PrintAndLog("CRC-8: %x",CRC8Maxim(buff, 13));\r
	141	\r
	142	//config = { 0, FALSE};\r
	143	return 0;\r
	144	}\r
	145	\r
	146	// detect configuration?\r
	147	\r
54a942b0	148	int CmdReadBlk(const char *Cmd)\r
54a942b0	149	{\r
c6be64da	150	int block = -1;\r
4ecde0e1	151	int password = 0xFFFFFFFF; //default to blank Block 7\r
83a42ef9	152	\r
4ecde0e1	153	char cmdp = param_getchar(Cmd, 0);\r
83a42ef9	154	if (cmdp == 'h' \|\| cmdp == 'H')\r
83a42ef9	155	return usage_t55xx_read();\r
54a942b0	156	\r
4ecde0e1	157	int res = sscanf(Cmd, "%d %x", &block, &password);\r
54a942b0	158	\r
4ecde0e1	159	if ( res < 1 \|\| res > 2 ){\r
68008fb5	160	usage_t55xx_read();\r
4ecde0e1	161	return 1;\r
	162	}\r
	163	\r
	164	if ((block < 0) \| (block > 7)) {\r
b44e5233	165	PrintAndLog("Block must be between 0 and 7");\r
b44e5233	166	return 1;\r
4ecde0e1	167	} \r
54a942b0	168	\r
4ecde0e1	169	UsbCommand c = {CMD_T55XX_READ_BLOCK, {0, block, 0}};\r
4ecde0e1	170	c.d.asBytes[0] = 0x0; \r
54a942b0	171	\r
4ecde0e1	172	//Password mode\r
	173	if ( res == 2 ) {\r
	174	c.arg[2] = password;\r
	175	c.d.asBytes[0] = 0x1; \r
c4e3b1b6	176	}\r
54a942b0	177	\r
b44e5233	178	SendCommand(&c);\r
68008fb5	179	if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r
c4e3b1b6	180	PrintAndLog("command execution time out");\r
385f3987	181	return 2;\r
c4e3b1b6	182	}\r
f38a1528	183	\r
68008fb5	184	uint8_t got[12000];\r
	185	GetFromBigBuf(got,sizeof(got),0);\r
	186	WaitForResponse(CMD_ACK,NULL);\r
a501c82b	187	\r
68008fb5	188	setGraphBuf(got, 12000);\r
83a42ef9	189	\r
	190	if (block == 0){\r
	191	// try a detection.\r
	192	\r
	193	}\r
68008fb5	194	\r
83a42ef9	195	if (CmdDetectClockRate("f")){ //wave is almost certainly FSK\r
	196	//call FSK DEMOD\r
	197	// FSK\r
	198	if ( FSKrawDemod("", FALSE))\r
	199	printT55xx("FSK");\r
	200	// FSK inverted\r
	201	if ( FSKrawDemod("1", FALSE)) \r
	202	printT55xx("FSK inv");\r
	203	} else {\r
	204	// ASK/MAN (autoclock, normal, maxerrors 1)\r
	205	if ( ASKmanDemod("0 0 1", FALSE, FALSE) )\r
	206	printT55xx("ASK/MAN");\r
	207	\r
	208	// ASK/MAN (autoclock, inverted, maxerrors 1)\r
	209	if ( ASKmanDemod("0 1 1", FALSE, FALSE) )\r
	210	printT55xx("ASK/MAN Inv");\r
	211	\r
	212	// NZR (autoclock, normal, maxerrors 1)\r
	213	if ( NRZrawDemod("0 0 1", FALSE) )\r
	214	printT55xx("NZR");\r
	215	// NZR (autoclock, inverted, maxerrors 1)\r
	216	if ( NRZrawDemod("0 1 1", FALSE) )\r
	217	printT55xx("NZR inv");\r
	218	\r
	219	// PSK (autoclock, normal, maxerrors 1)\r
	220	if (!PSKDemod("0 0 1", FALSE))\r
	221	printT55xx("PSK");\r
	222	\r
	223	// PSK (autoclock, inverted, maxerrors 1)\r
	224	if (!PSKDemod("0 1 1", FALSE))\r
	225	printT55xx("PSK inv");\r
	226	}\r
	227	return 0;\r
	228	}\r
	229	\r
	230	void printT55xx(const char *demodStr){\r
68008fb5	231	\r
83a42ef9	232	uint32_t blockData = 0;\r
	233	uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};\r
	234	\r
68008fb5	235	if ( !DemodBufferLen) \r
83a42ef9	236	return;\r
4e7af352	237	\r
83a42ef9	238	int i =0;\r
68008fb5	239	for (;i<DemodBufferLen;++i)\r
68008fb5	240	bits[i]=DemodBuffer[i];\r
385f3987	241	\r
0310364d	242	blockData = PackBits(1, 32, bits);\r
83a42ef9	243	PrintAndLog("0x%08X %s [%s]", blockData, sprint_bin(bits+1,32), demodStr );\r
54a942b0	244	}\r
54a942b0	245	\r
4e7af352	246	/*\r
	247	FSK1 / FSK1a\r
	248	size = fskdemod(dest, size, 32, 0, 8, 10); // fsk1 RF/32 \r
	249	size = fskdemod(dest, size, 32, 1, 8, 10); // fsk1a RF/32 \r
	250	\r
	251	FSK2 / FSK2a\r
	252	size = fskdemod(dest, size, 32, 0, 10, 8); // fsk2 RF/32 \r
	253	size = fskdemod(dest, size, 32, 1, 10, 8); // fsk2a RF/32 \r
	254	size = fskdemod(dest, size, 50, 1, 10, 8); // fsk2a RF/50 \r
	255	size = fskdemod(dest, size, 64, 1, 10, 8); // FSK2a RF/64 \r
	256	\r
	257	PSK1\r
	258	errCnt = pskRawDemod(bits, &bitlen, 32, 0);\r
	259	*/\r
54a942b0	260	int CmdWriteBlk(const char *Cmd)\r
54a942b0	261	{\r
4ecde0e1	262	int block = 8; //default to invalid block\r
	263	int data = 0xFFFFFFFF; //default to blank Block \r
	264	int password = 0xFFFFFFFF; //default to blank Block 7\r
	265	\r
	266	char cmdp = param_getchar(Cmd, 0);\r
	267	if (cmdp == 'h' \|\| cmdp == 'H') {\r
68008fb5	268	usage_t55xx_write();\r
4ecde0e1	269	return 0;\r
	270	}\r
	271	\r
	272	int res = sscanf(Cmd, "%d %x %x",&block, &data, &password);\r
	273	\r
	274	if ( res < 2 \|\| res > 3) {\r
68008fb5	275	usage_t55xx_write();\r
4ecde0e1	276	return 1;\r
4ecde0e1	277	}\r
54a942b0	278	\r
4ecde0e1	279	if (block > 7) {\r
b44e5233	280	PrintAndLog("Block must be between 0 and 7");\r
b44e5233	281	return 1;\r
f38a1528	282	}\r
4ecde0e1	283	\r
	284	UsbCommand c = {CMD_T55XX_WRITE_BLOCK, {data, block, 0}};\r
	285	c.d.asBytes[0] = 0x0; \r
54a942b0	286	\r
68008fb5	287	PrintAndLog("Writing to T55x7");\r
	288	PrintAndLog("block : %d", block);\r
	289	PrintAndLog("data : 0x%08X", data);\r
	290	\r
	291	//Password mode\r
	292	if (res == 3) {\r
4ecde0e1	293	c.arg[2] = password;\r
4ecde0e1	294	c.d.asBytes[0] = 0x1; \r
68008fb5	295	PrintAndLog("pwd : 0x%08X", password);\r
4ecde0e1	296	}\r
4ecde0e1	297	SendCommand(&c);\r
4ecde0e1	298	return 0;\r
54a942b0	299	}\r
	300	\r
	301	int CmdReadTrace(const char *Cmd)\r
	302	{\r
0310364d	303	uint8_t bits[MAX_GRAPH_TRACE_LEN] = {0x00};\r
f38a1528	304	\r
0310364d	305	char cmdp = param_getchar(Cmd, 0);\r
0310364d	306	\r
fbceacc5	307	if (strlen(Cmd) > 1 \|\| cmdp == 'h' \|\| cmdp == 'H') {\r
4ecde0e1	308	usage_t55xx_trace();\r
fbceacc5	309	return 0;\r
fbceacc5	310	}\r
f38a1528	311	\r
fbceacc5	312	if ( strlen(Cmd)==0){\r
c4e3b1b6	313	\r
fbceacc5	314	UsbCommand c = {CMD_T55XX_READ_TRACE, {0, 0, 0}};\r
fbceacc5	315	SendCommand(&c);\r
68008fb5	316	if ( !WaitForResponseTimeout(CMD_ACK,NULL,2500) ) {\r
	317	PrintAndLog("command execution time out");\r
	318	return 1;\r
	319	}\r
	320	//darn\r
	321	//CmdSamples("12000");\r
f38a1528	322	}\r
f38a1528	323	\r
83a42ef9	324	size_t bitlen = getFromGraphBuf(bits);\r
	325	if ( bitlen == 0 )\r
	326	return 2;\r
	327	\r
f6c18637	328	RepaintGraphWindow();\r
b44e5233	329	\r
f6c18637	330	uint8_t si = 5;\r
0310364d	331	uint32_t bl0 = PackBits(si, 32, bits);\r
0310364d	332	uint32_t bl1 = PackBits(si+32, 32, bits);\r
f6c18637	333	\r
0310364d	334	uint32_t acl = PackBits(si, 8, bits); si += 8;\r
	335	uint32_t mfc = PackBits(si, 8, bits); si += 8;\r
	336	uint32_t cid = PackBits(si, 5, bits); si += 5;\r
	337	uint32_t icr = PackBits(si, 3, bits); si += 3;\r
	338	uint32_t year = PackBits(si, 4, bits); si += 4;\r
	339	uint32_t quarter = PackBits(si, 2, bits); si += 2;\r
	340	uint32_t lotid = PackBits(si, 12, bits); si += 12;\r
	341	uint32_t wafer = PackBits(si, 5, bits); si += 5;\r
	342	uint32_t dw = PackBits(si, 15, bits); \r
f6c18637	343	\r
	344	PrintAndLog("");\r
	345	PrintAndLog("-- T55xx Trace Information ----------------------------------");\r
	346	PrintAndLog("-------------------------------------------------------------");\r
	347	PrintAndLog(" ACL Allocation class (ISO/IEC 15963-1) : 0x%02X (%d)", acl, acl);\r
	348	PrintAndLog(" MFC Manufacturer ID (ISO/IEC 7816-6) : 0x%02X (%d)", mfc, mfc);\r
	349	PrintAndLog(" CID : 0x%02X (%d)", cid, cid);\r
	350	PrintAndLog(" ICR IC Revision : %d",icr );\r
	351	PrintAndLog(" Manufactured");\r
	352	PrintAndLog(" Year/Quarter : %d/%d",2000+year, quarter );\r
77376577	353	PrintAndLog(" Lot ID : %d", lotid );\r
f6c18637	354	PrintAndLog(" Wafer number : %d", wafer);\r
	355	PrintAndLog(" Die Number : %d", dw);\r
	356	PrintAndLog("-------------------------------------------------------------");\r
77376577	357	PrintAndLog(" Raw Data - Page 1");\r
0310364d	358	PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bits+5,32) );\r
0310364d	359	PrintAndLog(" Block 0 : 0x%08X %s", bl1, sprint_bin(bits+37,32) );\r
f6c18637	360	PrintAndLog("-------------------------------------------------------------");\r
	361	/*\r
	362	TRACE - BLOCK O\r
	363	Bits Definition HEX\r
	364	1-8 ACL Allocation class (ISO/IEC 15963-1) 0xE0 \r
	365	9-16 MFC Manufacturer ID (ISO/IEC 7816-6) 0x15 Atmel Corporation\r
	366	17-21 CID 0x1 = Atmel ATA5577M1 0x2 = Atmel ATA5577M2 \r
	367	22-24 ICR IC revision\r
	368	25-28 YEAR (BCD encoded) 9 (= 2009)\r
	369	29-30 QUARTER 1,2,3,4 \r
77376577	370	31-32 LOT ID\r
f6c18637	371	\r
f6c18637	372	TRACE - BLOCK 1\r
77376577	373	1-12 LOT ID \r
f6c18637	374	13-17 Wafer number\r
	375	18-32 DW, die number sequential\r
	376	*/\r
	377	\r
	378	return 0;\r
	379	}\r
f38a1528	380	\r
f6c18637	381	int CmdInfo(const char *Cmd){\r
	382	/*\r
	383	Page 0 Block 0 Configuration data.\r
	384	Normal mode\r
	385	Extended mode\r
	386	*/\r
fbceacc5	387	char cmdp = param_getchar(Cmd, 0);\r
fbceacc5	388	\r
83a42ef9	389	if (cmdp == 'h' \|\| cmdp == 'H') {\r
83a42ef9	390	return usage_t55xx_info();\r
4ecde0e1	391	} else {\r
fbceacc5	392	CmdReadBlk("0");\r
081151ea	393	} \r
fbceacc5	394	\r
83a42ef9	395	// config\r
83a42ef9	396	\r
c6be64da	397	uint8_t bits[LF_BITSSTREAM_LEN] = {0x00};\r
8d0a3e87	398	\r
83a42ef9	399	uint8_t si = 1;\r
8d0a3e87	400	uint32_t bl0 = PackBits(si, 32, bits);\r
f6c18637	401	\r
8d0a3e87	402	uint32_t safer = PackBits(si, 4, bits); si += 4; \r
	403	uint32_t resv = PackBits(si, 7, bits); si += 7;\r
	404	uint32_t dbr = PackBits(si, 3, bits); si += 3;\r
	405	uint32_t extend = PackBits(si, 1, bits); si += 1;\r
	406	uint32_t datamodulation = PackBits(si, 5, bits); si += 5;\r
	407	uint32_t pskcf = PackBits(si, 2, bits); si += 2;\r
	408	uint32_t aor = PackBits(si, 1, bits); si += 1; \r
	409	uint32_t otp = PackBits(si, 1, bits); si += 1; \r
	410	uint32_t maxblk = PackBits(si, 3, bits); si += 3;\r
	411	uint32_t pwd = PackBits(si, 1, bits); si += 1; \r
	412	uint32_t sst = PackBits(si, 1, bits); si += 1; \r
	413	uint32_t fw = PackBits(si, 1, bits); si += 1;\r
	414	uint32_t inv = PackBits(si, 1, bits); si += 1; \r
	415	uint32_t por = PackBits(si, 1, bits); si += 1;\r
b44e5233	416	\r
f6c18637	417	PrintAndLog("");\r
99a71418	418	PrintAndLog("-- T55xx Configuration & Tag Information --------------------");\r
f6c18637	419	PrintAndLog("-------------------------------------------------------------");\r
	420	PrintAndLog(" Safer key : %s", GetSaferStr(safer));\r
	421	PrintAndLog(" reserved : %d", resv);\r
	422	PrintAndLog(" Data bit rate : %s", GetBitRateStr(dbr));\r
	423	PrintAndLog(" eXtended mode : %s", (extend) ? "Yes - Warning":"No");\r
	424	PrintAndLog(" Modulation : %s", GetModulationStr(datamodulation) );\r
	425	PrintAndLog(" PSK clock freq : %d", pskcf);\r
	426	PrintAndLog(" AOR - Answer on Request : %s", (aor) ? "Yes":"No");\r
	427	PrintAndLog(" OTP - One Time Pad : %s", (otp) ? "Yes - Warning":"No" );\r
	428	PrintAndLog(" Max block : %d", maxblk);\r
	429	PrintAndLog(" Password mode : %s", (pwd) ? "Yes":"No");\r
	430	PrintAndLog(" Sequence Start Terminator : %s", (sst) ? "Yes":"No");\r
	431	PrintAndLog(" Fast Write : %s", (fw) ? "Yes":"No");\r
	432	PrintAndLog(" Inverse data : %s", (inv) ? "Yes":"No");\r
	433	PrintAndLog(" POR-Delay : %s", (por) ? "Yes":"No");\r
	434	PrintAndLog("-------------------------------------------------------------");\r
77376577	435	PrintAndLog(" Raw Data - Page 0");\r
8d0a3e87	436	PrintAndLog(" Block 0 : 0x%08X %s", bl0, sprint_bin(bits+5,32) );\r
f6c18637	437	PrintAndLog("-------------------------------------------------------------");\r
	438	\r
	439	return 0;\r
	440	}\r
	441	\r
77376577	442	int CmdDump(const char *Cmd){\r
77376577	443	\r
4ecde0e1	444	char s[20] = {0x00};\r
77376577	445	uint8_t pwd[4] = {0x00};\r
54a942b0	446	\r
4ecde0e1	447	char cmdp = param_getchar(Cmd, 0);\r
149aeada	448	if ( cmdp == 'h' \|\| cmdp == 'H') {\r
4ecde0e1	449	usage_t55xx_dump();\r
77376577	450	return 0;\r
77376577	451	}\r
4ecde0e1	452	\r
4ecde0e1	453	bool hasPwd = ( strlen(Cmd) > 0); \r
77376577	454	if ( hasPwd ){\r
2ae8a312	455	if (param_gethex(Cmd, 0, pwd, 8)) {\r
2ae8a312	456	PrintAndLog("password must include 8 HEX symbols");\r
c4e3b1b6	457	return 1;\r
77376577	458	}\r
77376577	459	}\r
a501c82b	460	\r
77376577	461	for ( int i = 0; i <8; ++i){\r
149aeada	462	memset(s,0,sizeof(s));\r
77376577	463	if ( hasPwd ) {\r
c6be64da	464	sprintf(s,"%d %02x%02x%02x%02x", i, pwd[0],pwd[1],pwd[2],pwd[3]);\r
77376577	465	} else {\r
77376577	466	sprintf(s,"%d", i);\r
77376577	467	}\r
4ecde0e1	468	CmdReadBlk(s);\r
77376577	469	}\r
	470	return 0;\r
	471	}\r
	472	\r
f6c18637	473	char * GetBitRateStr(uint32_t id){\r
	474	static char buf[40];\r
	475	char *retStr = buf;\r
	476	switch (id){\r
	477	case 0: \r
	478	sprintf(retStr,"%d - RF/8",id);\r
	479	break;\r
	480	case 1:\r
	481	sprintf(retStr,"%d - RF/16",id);\r
	482	break;\r
	483	case 2: \r
	484	sprintf(retStr,"%d - RF/32",id);\r
	485	break;\r
	486	case 3:\r
	487	sprintf(retStr,"%d - RF/40",id);\r
	488	break;\r
	489	case 4:\r
	490	sprintf(retStr,"%d - RF/50",id);\r
	491	break;\r
	492	case 5:\r
	493	sprintf(retStr,"%d - RF/64",id);\r
	494	break;\r
	495	case 6:\r
	496	sprintf(retStr,"%d - RF/100",id);\r
	497	break;\r
	498	case 7:\r
	499	sprintf(retStr,"%d - RF/128",id);\r
	500	break;\r
	501	default:\r
	502	sprintf(retStr,"%d - (Unknown)",id);\r
	503	break;\r
	504	}\r
	505	\r
	506	return buf;\r
	507	}\r
	508	\r
f6c18637	509	char * GetSaferStr(uint32_t id){\r
	510	static char buf[40];\r
	511	char *retStr = buf;\r
	512	\r
	513	sprintf(retStr,"%d",id);\r
	514	if (id == 6) {\r
	515	sprintf(retStr,"%d - pasdwd",id);\r
	516	}\r
	517	if (id == 9 ){\r
	518	sprintf(retStr,"%d - testmode ",id);\r
	519	}\r
	520	\r
	521	return buf;\r
	522	}\r
	523	char * GetModulationStr( uint32_t id){\r
	524	static char buf[40];\r
	525	char *retStr = buf;\r
	526	\r
	527	switch (id){\r
	528	case 0: \r
7bd30f12	529	sprintf(retStr,"%d - DIRECT (ASK/NRZ)",id);\r
f6c18637	530	break;\r
	531	case 1:\r
	532	sprintf(retStr,"%d - PSK 1 phase change when input changes",id);\r
	533	break;\r
	534	case 2: \r
	535	sprintf(retStr,"%d - PSK 2 phase change on bitclk if input high",id);\r
	536	break;\r
	537	case 3:\r
	538	sprintf(retStr,"%d - PSK 3 phase change on rising edge of input",id);\r
	539	break;\r
	540	case 4:\r
	541	sprintf(retStr,"%d - FSK 1 RF/8 RF/5",id);\r
	542	break;\r
	543	case 5:\r
	544	sprintf(retStr,"%d - FSK 2 RF/8 RF/10",id);\r
	545	break;\r
	546	case 6:\r
	547	sprintf(retStr,"%d - FSK 1a RF/5 RF/8",id);\r
	548	break;\r
	549	case 7:\r
	550	sprintf(retStr,"%d - FSK 2a RF/10 RF/8",id);\r
	551	break;\r
	552	case 8:\r
	553	sprintf(retStr,"%d - Manschester",id);\r
	554	break;\r
	555	case 16:\r
	556	sprintf(retStr,"%d - Biphase",id);\r
	557	break;\r
	558	case 17:\r
	559	sprintf(retStr,"%d - Reserved",id);\r
	560	break;\r
	561	default:\r
	562	sprintf(retStr,"0x%02X (Unknown)",id);\r
	563	break;\r
	564	}\r
	565	return buf;\r
	566	}\r
	567	\r
f6c18637	568	uint32_t PackBits(uint8_t start, uint8_t len, uint8_t* bits){\r
	569	\r
	570	int i = start;\r
	571	int j = len-1;\r
3bc3598e	572	if (len > 32) {\r
	573	return 0;\r
	574	}\r
f6c18637	575	uint32_t tmp = 0;\r
	576	for (; j >= 0; --j, ++i){\r
	577	tmp \|= bits[i] << j;\r
	578	}\r
	579	return tmp;\r
54a942b0	580	}\r
	581	\r
	582	static command_t CommandTable[] =\r
	583	{\r
83a42ef9	584	{"help", CmdHelp, 1, "This help"},\r
	585	{"config", CmdT55xxSetConfig, 1, "Set T55XX config for modulation, inversed data"},\r
	586	{"read", CmdReadBlk, 0, "<block> [password] -- Read T55xx block data (page 0) [optional password]"},\r
	587	{"write", CmdWriteBlk, 0, "<block> <data> [password] -- Write T55xx block data (page 0) [optional password]"},\r
	588	{"trace", CmdReadTrace, 0, "[1] Read T55xx traceability data (page 1/ blk 0-1)"},\r
	589	{"info", CmdInfo, 0, "[1] Read T55xx configuration data (page 0/ blk 0)"},\r
	590	{"dump", CmdDump, 0, "[password] Dump T55xx card block 0-7. [optional password]"},\r
54a942b0	591	{NULL, NULL, 0, NULL}\r
	592	};\r
	593	\r
	594	int CmdLFT55XX(const char *Cmd)\r
	595	{\r
	596	CmdsParse(CommandTable, Cmd);\r
	597	return 0;\r
	598	}\r
	599	\r
	600	int CmdHelp(const char *Cmd)\r
	601	{\r
	602	CmdsHelp(CommandTable);\r
	603	return 0;\r
	604	}\r